CVE-2026-82285: Server-Side Request Forgery (SSRF) in dataelement bisheng

CVE-2026-82285 is a server-side request forgery vulnerability affecting dataelement's bisheng product through version 2.6.0-fix2. The vulnerability exists in the POST /api/v1/workflow/report/callback endpoint, which lacks authentication and does not apply URL scheme restrictions or host filtering. This allows unauthenticated attackers to submit arbitrary URLs, potentially enumerating internal network services and cloud metadata endpoints. The attacker can then retrieve the captured responses from object storage by specifying object names. The CVSS 4.0 base score is 8.8, indicating a high severity vulnerability with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

An unauthenticated attacker can exploit this SSRF vulnerability to access internal network services and cloud metadata endpoints that are normally inaccessible externally. This can lead to information disclosure of sensitive internal resources. The attacker can also retrieve response data stored in object storage, potentially exposing confidential information. The vulnerability does not require authentication or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and implement network-level controls to prevent unauthorized internal requests. Apply strict input validation to restrict allowed URL schemes and hosts if possible.